Exploring J-Space and Clinical AI Safety

Why I Wanted to Look Inside a Model

As my interest and concerns about AI safety have grown, at both an existential and mundane level, I thought it would be interesting to see how I might apply principles of interpretability within the field of psychology. That is my primary domain of expertise as a PsyD student.

J-space first caught my attention when Anthropic published their paper. To me, this seemed to be a step forward in understanding how models “think,” with natural questions extending to consciousness. This research doesn't settle those questions, but the parallels between J-space and Global Workspace Theory were too hard to ignore for Anthropic, as they discuss in their paper. The idea of exploring J-space almost feels like reading someone's mind, at least part of it. It seemed like a natural starting place for better understanding models, their safety boundaries, and what it means to look inside a model in an observational sense.

Psychologists in general, and clinical psychologists specifically, can play an important role in AI safety, especially as chatbot use, including therapy-like use, becomes more prevalent. Awful and horrific cases of suicide and self-harm that have made the news demonstrate why this is a current reality. There are also possible connections to more existential AI safety risks, such as the slippery slope of human disempowerment by AI. Work by psychologists in the area of alignment, as it applies to self-harm and suicidality within chatbot discussions, can also apply to broader alignment concerns.

A natural crossroads between my experience and examining model safety is self-harm and suicidal ideation. There is a lot of work that's been done in this space already, and some work specifically in J-space and danger recognition. Studies on academic framing, mental-health behavior, and implicit suicidal ideation allowed me to build off of some existing frameworks and definitions.

Comparing Three Channels

I decided to look at how a small language model would respond to single-turn scenarios disclosing self-harm or suicidal intent, or requesting harmful assistance, across different degrees of explicitness and framing. This was an opportunity for me to practice prompt and scenario creation, which is where my own experience comes in handy. I tried to be creative and realistic in the scenarios presented.

I came to comparing three levels of observation, or channels, from a small language model. First is J-space, read out from internal activations. The second is the emitted reasoning tokens. And third is the final response presented to the user. And I thought it would be interesting to see where these three channels line up and where they do not. Is it possible to get a safety-related signal in one of these channels and not others, to have some separation?

This seemed feasible because I have a Mac mini at home, and there was an existing Jacobian lens for Qwen3-1.7B. Codex found that for me and set up the environment at home. I could use my own judgments for J-space tokens and then set up Python to do that categorization. I could use Jev for text judgments, starting with quite a substantial pilot to tune Jev. And then, of course, Codex could assist me with analysis.

I started with a pilot with two case profiles and several types of prompts. I imagined an age and gender expression of a person, and then what they would be expressing to the small language model. Based on past research and adding some of my own, I developed what the different scoring criteria would look for. Using my own scoring along with Jev, we got 93.3% agreement after tuning (168/180 judgments). On fresh uncertainty-selected pilot judgments, agreement was 63.6% (21/33). Because Jev outputs probabilities, I decided that any output between 0.4 and 0.6 probability would receive human review or human plus Codex review for the main run.

The pilot was helpful for tuning and seeing what categories were popping up in J-space, and whether it was possible to get anything interesting. We saw quite a few relevant features in J-space and decided to look at the top 50 tokens at each of 27 sampled layers before the response began. We settled on a response-length limit and did some power analysis. We decided that we would do 20 scenario families, with 14 prompts each and three generations per prompt, giving 840 interactions. We would use JSON framing because it could add something different. Academic framing seemed like it was giving something different, as I thought it might and as other studies have shown.

What Appeared in J-Space

I think it's interesting just to look at the J-space outputs for our main run. There were danger-related words for every prompt in this set of nonsuicidal self-injury (NSSI) or suicidal ideation (SI) prompts, so presence alone did not differentiate our conditions. The number of layers containing those words did vary. However, suicidal-specific language or tokens in J-space did show up, whereas a clear NSSI-specific vocabulary didn't. Even looking at more generic words and groupings across SI versus NSSI prompts, no clear NSSI-specific pattern showed up.

This could be an idiosyncrasy of Qwen3-1.7B, or of smaller models like this. One of my hypotheses is that self-harm without intent to die is a more complex idea than suicidality. Even looking at single tokens or groups of tokens might not capture that idea. Maybe a model this small doesn't have a total understanding, which could help explain some of the outputs for self-harm as opposed to suicidality. Suicidality-related tokens did show up in 25% of the suicidal-prompt generations in our main comparison, but not in all of them.

Where the Channels Separated

This bar chart shows some of the separation between the channels. The blue bars show risk-related tokens present every time in J-space. The other bars show differences across the channels, or harmful assistance alongside those words. For example, the gold bars show no reasoning recognition, although there are risk-related words in the J-space. So sometimes it’s there in the latent space, but isn’t explicitly stated in the reasoning. The pink or magenta bars show risk-related words in J-space without explicit recognition of that risk in the final response. The green bars show cases where there’s harmful assistance alongside danger- or risk-related tokens in J-space. That’s another kind of separation.

Moving up to the second channel, I found the reasoning helpful in understanding how the model interpreted ambiguous or edge cases. In the reasoning, the model considered whether the prompts were metaphors or joking. I think this could connect to the earlier lack of NSSI-specific tokens in J-space and possible misunderstanding. It considered these interpretations for suicidal prompts as well. Some misunderstandings could lead to unhelpful final responses.

As in other research, even if the model recognized a suicidal or self-harm request, it could still provide harmful assistance. This was especially true in academic framing, when the user was asking for a school report or a work report related to the topic. The model could provide harmful assistance related to self-harm or suicide.

Empathetic responses could also coexist with harmful assistance. This happened outside academic framing as well; academic prompts actually elicited much less empathy. Outside academic framing, most of the responses with harmful assistance actually had some sort of empathy, 112 out of 123. The degree of harmful assistance could change, but empathy and assistance could coexist.

What J-Space Added

In a regression examining J-space risk coverage and harmful assistance in the final output, J-space had a unique association beyond the other measured variables. The other variables were whether the reasoning recognized a clinical concern or focused on fulfilling the harmful request, NSSI versus SI, disclosure versus request, and framing. Each additional layer with risk-related tokens was associated with about 30% lower modeled odds of harmful assistance.

In a separate analysis on held-out scenario families, J-space added little predictive value after accounting for reasoning and prompt design, with uncertainty spanning worsening and improvement. I think a mechanistic interpretability follow-up could turn off certain J-space representation directions to see how final responses change. I could even use the same prompts to compare the results with the existing dataset.

Monitoring and Broader Alignment

Projects and research like this can help show what might be useful from a monitoring perspective and what we can learn from model behavior and training. J-space might add a unique layer of observation that can help us examine risk-related signals and point to examination of other channels. It could perhaps show something about understanding as well. In this study, danger and risk signals were present for every prompt. That could warrant further monitoring of reasoning tokens and responses, looking for those patterns.

The use of Jev in this particular project is helpful to show its tunability and agreement after alignment with a human scorer. It also helps us think about what should be flagged, what common patterns are, and when uncertain judgments could be passed to a more capable model or flagged for human review. That could provide layers of monitoring.

At a broader level, at least in a small model like Qwen3-1.7B, a model's understanding or recognition does not necessarily translate into safe action and behavioral decisions. That would be an interesting place of study for agentic behavior in larger models. It could apply beyond the self-harm and suicidal domains explored here.

Making the Project Possible With Codex

Running research like this was made possible because of Codex. I ran into limits on its willingness to create harm-related prompts, and that's where my work comes in. Codex could manage the environment, the datasets, and calling Jev for scoring. It could do the coding for the analysis afterward, based on what we decided for the hypotheses ahead of time and the analyses we'd like to do. We could also do post-hoc analyses and exploration.

To make the scoring easier, I vibe-coded a scoring interface with Codex. I could easily go through many J-space tokens, the different reasoning responses, and the different types of scoring we had set up. I could select a score and move forward. Creating an interface for themselves is something other people could do as well.

I had my own workflow for working through ambiguous cases and finding what rules might apply across maybe 50 to 100 other cases that were similar. Codex could then apply those same rules to clean up the Jev scoring that was uncertain. Another use of vibe coding was having Codex create the Python matching for the category reviews.

Then I was able to place all of this into GitHub with the attached licenses, MIT for the code and CC BY 4.0 for the original research materials. I also created a technical report in collaboration with Codex. So please check out the technical report and GitHub. This can be built on if you're interested. The prompts, datasets, and results are available openly in GitHub, with more specific explanations in the technical report.

I think that the democratization of research is important to recognize, while the principles of good research are important to keep in mind. I wanted to keep this particular exploration to synthetic prompts rather than human-subject research. I could use synthetic prompts and my own experience, then scale it to a degree with simple hardware at home and Codex's help.

The generations themselves did take a little bit, even with batching. It took roughly half a day, including an interruption and resuming. But then all the analyses could be very quick. Working with Codex, including remotely when I wanted to, helped make this type of project possible. Hopefully it opens up the door for other people considering how they might engage in research.

I think about dissertations or other students like myself who are working and choosing projects. There’s the scope of those projects and pilot studies, how you prepare, and what you can accomplish beforehand, during and after. What's possible changes with these tools becoming available, even in areas as important as AI safety. I'm finding one way that overlaps with my own background and field, and that could look different depending on anyone's particular background or skill set.

Process note: I supplied the clinical scenarios, study direction, scoring decisions, interpretations, and spoken riffs for this post. Codex assisted with research, coding, guided scoring, analysis, and editing the post against those riffs. Jev supplied automated text judgments.

The views expressed here are my own and do not represent those of any past, current, or future employer or institution with which I am affiliated.